Read the docs
TI-2026-08239 Aliases CVE-2026-9390GHSA-mhmm-7px6-jx3j

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup

Priority MEDIUM 48CWE-1287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators. A crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00505 43rd percentileScored 2026-11-07
Fix Fixed XML::Sig (TIMLEGGE): 0.71

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TIMLEGGEXML::Sigbefore 0.710.71Patch availableCNA
  • XML::Sig VendorTIMLEGGE Affected before 0.71 Fixed in 0.71 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xml\:\:sig_project:xml\:\:sig:*:*:*:*:*:perl:*:*sig_project xml\VulnerableXml
  • cpe:2.3:a:xml\:\:sig_project:xml\:\:sig:*:*:*:*:*:perl:*:* Versions sig_project xml\ Vulnerable ·Xml

Remediation

  • Fix · CNA XML::Sig (TIMLEGGE) Fixed in 0.71

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    TIMLEGGE XML::Sig 0.71

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-08334 Improper signature verification in TIMLEGGE XML::SigPriority MEDIUM 47
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9390
  2. 2026-10-03 Alias added: GHSA-mhmm-7px6-jx3j

References

Patch 2

Other 1

  • TI-2026-23735 Integer overflow in TIMLEGGE Crypt::NaCl::Sodium CVSS 3.1CRITICAL 9.8
  • TI-2020-18981 IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library CVSS 3.1CRITICAL 9.8
  • TI-2026-14905 Improper signature verification in TIMLEGGE Net::SAML2 CVSS 3.1CRITICAL 9.8
  • TI-2026-10497 Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to… CVSS 3.1CRITICAL 9.1
  • TI-2026-08334 Improper signature verification in TIMLEGGE XML::Sig CVSS 3.1CRITICAL 9.1
  • TI-2026-02211 Integer overflow in TIMLEGGE Crypt::NaCl::Sodium CVSS 3.1CRITICAL 9.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences